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INTRODUCTION TO OPERATING PHILOSOPHY 


This Introduction is written for the reader vdto may be unfamil- 
iar with the Panel's role and to inform traditional users of the 
Panel's report of changes in our operation* 

Tlie Panel is created and chartered by Congress as a senior ad- 
visory group to NASA management, most specifically the NASA Admini- 
strator. The members are appointed by public law for six-year- terms. 
TIte criteria for their selection include executive experience and 
knowledge oi‘ the requirements of running ‘ large organizations where 
development programs have inherent risks and appropriate policies 
have to be evolved. Members must also be sensitive to the account- 
ability requirements facing senior public officials. 

The Panel conducts its work as spelled out in the NASA policy 
on the Panel: 

"Pursuant to carrying out its statuatory duties 
the Panel will review, evaluate and advise on those 
program management policies, management systems, 
procedures and practices chat contribute to risk 
identification and assessment by management. Pri- 
ority shall be given to Chose programs that in- 
volve the safety of manned flight." (NMI 1156. 14C) 

Through its inspections, the Panel requires project numagement at both 
NASA and contractor levels to review and explicitly explain their tech- 
nical management system and decision making processes, Che basis for 
confidence in crew safety and the rationale for risks that have to be 
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accepted. On Apollo, Skylab and ASTP the Panel principally operated 
through on-elte Inepectlone by the Cull Panel. The Panel, however, 
augmented Ita approach of Cull Panel inepectlone with detailed fact- 
finding by epecific teame and deeignated indivlduale. Thie wae done 
in order to gain greater vieibllity into eigniCicant areae on Shuttle. 

The Panel 'a approach relnCorcee and eupporta decieion making that 
minimizea crew rlak and eervee to aaeure probleme are worked in a timely 
manner and at the loweat appropriate management level. The Panel' a re- 
port to the Adminlatrator and Congreaa eeeka to provide them indepen- 
dent aaaeaament and aubatantial InCotmatlon to aid them In their over- 
sight reaponaiblllty and keeps before senior flight management's atten- 
tion thoae isaues critical to crew safety. The Panel thus contributes 
to (1) policy formulation, (2) program planning anc rccompllshroent of 
program objectives more effectively, (3) agency management decision 
making, and (4) achievement of economies In the program. Examples are 
cited In the report to the Office of Management and Budget, Appendix A. 
More detail Is provided in the Space Shuttle Program's response to the 
1976 Annual Report, Appendix B. 

The Panel Is very much aware of Its continuing responsibility to 
Congress 'and Is pleased that the House Conmlttee on Science and Tech- 
nology found the Panel's 1976 Annual Report useful for their own re- 
view. The Conmlttr^s "Space Shuttle 1977 Status Report" states that 
the Panel's Independent review and 1976 report "noted a nund>er of 
critical areas and recommended actions to be taken to strengthen the 
program. In making this (the Conmlttee' s) current review, the Panel's 
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comments were noted to aid in assessing the posture of the Space Shuttle 
Program." As the report notes, the first topic discussed in the issues 
section of this report is one that had been examined by the Panel. 

One of the Panel's objectives is to provide timely reports that 
add to both the public's informed understanding and the development of 
appropriate criteria of public accountability. Thus the Panel submits 
a comprehensive report. 

With its responsibilities to NASA, the Congress and the public in 
mind, the Panel submits this report. The report reflects the Panel's 
concentration on areas critical to a successful Approach and Landing 
Test Program (ALT) in 1977 as well as the critical elements for the 
Orbital Flight Test Program (OFT). 

The primary goal of Che Approach and Landing Test (ALT) program 
is Co gacher sufficienC flighc cesc daca Co verify safe Orbicer sub- 
sonic aerodynamic flighc and landing wich an Orbicer and ground oper- 
acions configured as closely as pracCical co Che hardware and soft- 
ware Co be used in Che approach and landing phase of orbital missions. 
The Panel focused on Chose ALT activities which provide certification 
of Che required program elements. 

Thub Che Panel reviewed Che following areas of major significance 
for ALT: mission planning and crew training, flight-readiness of Che 

Carrier Aircraft and the Orbicer including its flight control and avi- 
onics systems, facilities, communications and ground support equipment, 
and the management system for risk assessment. Our observations and 
recommendations are consolidated into the first two chapters of this 
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raportf The chapter on miaaion oparationa Includea an aaaaaamant of 
miaaion managament, miaaion planning) comrounicationa and ground oper* 
ationa. The chapter on vehiclea for ALT includea an aaaeaament of the 
Shuttle Carrier Aircraft (modified 747) and the Orbiter including the 
critical avionica and flight control ayatem. 

While the Orbital Flight Teat ’’rogram (OFT) la acheduled to begin 
in 1979 the major elementa are now in an advanced atate of deaign eval- 
uation, manufacturing and aaaembly. Our obaervationa and recomroenda- 
tlona are conaolidated into chapters on the Orbiter and the principal 
elementa of the Shuttle propulsion system, i.e., the Main Engine, the 
External Tank and the Solid Rocket Booster. 

The first volume contains the Panel's observations and recoimnen- 
dations and the second volume gives the supporting detail and summa- 
rizes the results of the Panel's inspection activities. 

As for the work plan for the current year the Panel plans to pro- 
vide flight-readiness assessment reports on each phase of the ALT test 
program where there is a significant new risk. Thus the Panel plans 
to submit short reports on (1) the first mated flight with the captive 
Orbiter manned and its systems active, (2) the first separation, approach, 
and landing of the Orbiter, and (3) the first capti\fe flight of the Orbiter 
in the orbital configuration without a tailcone. This will also be a 
major year for activities on the principal elements required for OFT 
since these are only two years from first flight. Furthermore, this is 
the time for the significant Critical Design Reviews as well as prep- 
arations for major ground tests to prove the designs. 
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ALT MISSION OPERATIONS 


A. OBSERVATIONS 

It la Important to begin by noting that one o£ the goals of ALT 
ia to configure mission and ground operations as closely to the approach 
used in the approach and landing phase of the orbital mission since that 
goal explains the management concept that put the flight of the vehicle 
under JSC direction and ground operations under KSC although the flights 
were physically to take place at DFRC. The Panel's initial thought was 
that it would have made management and communication simpler If the to> 
tal operation would have been under DPRC control but we recognize the 
tradeoff and focused on how the management concept would be made to 
work. 

This concept meant that a suitable organizational approach had to 
be implemented to direct and coordinate these efforts and we found that 
the Shuttle program had created a dedicated project organization with 
a sound management system. 

JSC "controls" the activities at DFRC including the checkout and 
the actual flights. The checkout is accomplished through the ACE sta- 
tion which is at Rockwell's manufacturing facility at Palmdale. Thus 
during checkout there will be data links from the Orbiter and support 
equipment at DFRC to Palmdale, Downey and JSC. As for flight control 
the combined active 747/Orbiter and active orbiter flying alone will be 
under direct JSC's Mission Control Center at all times. This has the 
advantage of exercising the communication and computer facilities at 
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JSC much as th«y will function during OFT and lat«r operational flights. 
The 747 when separated from the Orbiter will be under DFRC control. The 
flights of the 747 mated with the inert Orbiter, which were flown in 
February and March 1977, were under DFRC control at all times. 

Our review of the reliability of Ihe con^lex communications sys- 
tem to support a mission with a manned active Orbiter found that the 
program's policy is that any loss of comnunications between the car- 
rier/Orblter and JSC prior to separation will result in a decision not 
to separate the Orbiter. Loss of communications after separation is 
apparently an acceptable risk and it is assumed the Orbiter car. con- 
' xnue landing with no further assistance from JSC. Although there are 
redundant systems that make such a loss improbable, the Panel questioned 
the economy of eliminating DFRC as support center for an Orbiter approach 
and landing. 

The program's position is that tests of the communication system 
should provide adequate confidence in its reliability. There are no 
known reasons to doubt that the crew can land che Orbiter without 
assistance from JSC in the unlikely event of loss of communications 
between JSC and the Orbiter after separation. The Aerospace Safety 
Advisory Panel is satisfied that those responsible for the planning 
and testing of this system arc highly qualified and well aware of po- 
tential problems. The program has been keeping ahead of scheduled re- 
quirements and have planned extensive tests to assure the performance 
of the system. The comments in the recommendations are suggestions 
to enhance the margin of safety that is acknowledged to be there. 


Th« Pan«l, In contidarlng th« approach to miaalon planning, found 
that tha ALT program' a objactiva la to prograaa in minimum atapa con- 
aiatant with flight aafaty from taat conditiona that provida tha greac- 
eat margins of aafaty to taat conditions anticipated in the fi rat OFT 
approach and landing. This is a reasonable and prudent approach to 
taking tha necessary risks to meet the program objectives. We found 
the management system mado effective use of special working groups - 
such as the Flight Techniques Panel to coordinate the efforts of those 
involved in designing mission objectives and flight techniques to meet 
program objectives and to surface and resolve issues originating in 
differing viewpoints. 

Also, the Panel has been in a continuous discussion with the pro- 
gram on the planning of crew training. For instance, the Panel is 
pleased to learn that NASA utilizes the simulator at Ames. Here again 
our recomnendations are to enhance a program that Is reasonable. 

Finally, the Panel has reviewed the facilities and GSE associated 
with mission operations. Of special note is the method of lifting the 
Shuttle Orblter and the facilities for attaching It to the 747. The 
plans for checkout appear to be adequate but will require continual 
surveillance since the system contains several single-point failure 
possibilities which could cause major damage. 

Any program like ALT with so much experimental dimension in it 
will require changes along the way and this will too. Therefore, the 
Panel plans to review mission operations for each phase of the ALT 
program before It begins in light of the experience from prior missions 
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and the new requirementa for that phaae. Our objectivea will be to 
aaaeaa within the limita of our reaourcea the degViiof to which: 

1. The program management ayatem haa defined a aat of 
mlaaion rulea and a flii^t plan that providea a reaaonaMe baaia of 
confidence that the nominal flight plana can be aucceaa Cully executed. 

2. The flight planning proceaa haa uaed a conaervative 
approach in planning the nominal miaaion and providing for contingency 
and abort aituationa including emergency aeparation and jettiaon. 

B. HECOMMENDATi::<S 

1. In the lifting body flighta, the pilota were aubatantially 
aBBlated by calla from the control room where a pilot waa available 
ahowing the actual location the vehicle ar. compared with the planned 
locationa. The Panel ia very impreaaed by both the . Implicity and 
effectiveness of thi'j '^modified GCA" in assisting the busy pilot on 
these short flights. For ALT it is understood that such a plot ia 
planned at Mission Control JSC. It appears prudent to maintain the 
same plot at DFRC as a backup in the event of the highly unlikely but 
still possible loss of voice communications between Houston and Edwards. 
The Panel wonders what penalty the ALT would encounter by including this 
already’ available backup system. 

2. The closest actual experiences to the ALT flights are those 
that were gained during the lifting body and earlier rocket aircraft 
flights. We should not overlook any opportunity to use this background 
wherever appropriate. For example, it is suggested that lifting body 
pilots be requested to fly the STA and Orbiter simulators and provide 
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comiwntt on choir llighc oxporlonceo. Slmllartyi Ic may be uaeCul to 
have a general crlt;.que o£ ALT miealon plant by a group o£ experienced 
pertonnel who have not been Involved no date. Thia group might include 
tuch people at Chuck Yeager , Bob White, Bob Ruthworth and lifting body 
engineert of AFFTCt 

3. The Panel tuggeato that crew training might be enhanced by 
the ute of additional exltting aimulatora with capabilitlea different 
from airoulatori now being uted. For example, the Air Force tlmulator 
(AFFTC Engineering Simulatort) at Edwards AFB hat proved very valuable 
for lifting body training. The Air Force aimulator it not at compre- 
hensive as other such training devices, but changes in aerodynamic 
values ate easy to accomplish and should be useful In pilot training. 
Also, interaction between Air Force and NASA personnel would be enhanced. 

4. Experience in lifting body simulator training and missions 
show that pilots are able to accomplish tasks at a higher rate in the 
simulator than in actual flights. Use of "fast time" simulators for 
training is one way of Insuring that the pilot Is not overburdened in 
flight. It is reconsnendcd that the use of such a simulator be given 
further consideration. 
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THE VEHICLES FOR ALT 


A. OBSERVATIONS 

Th« ALT program calls for tha following phasaa: (1) matad flight 

of cha Shuttla Carrier Aircraft (modified 747) with an Inert unmanned 
Orblter» (2) mated flight with the captive Orblter manned and ayatama 
active, (3) separation and landing of the manned active Orblter with 
Its tailcone on, and (4) approach and landing of the Orblter In Its 
orbital configuration without the tailcone. 

The Panel has been monitoring the testing on the Shuttle Carrier 
Aircraft (747), Orblter 101 and the mated configuration through Its 
own Inspections and fact-finding as well as attendance at Internal 
program reviews such as the Critical Design Review and the Customer 
Acceptance and Readiness Reviews conducted for the actual flight hard- 
ware. It appears that the program to modify the 747 Into the carrier 
aircraft has gone well and the Panel sees no critical areas for top 
management attention. 

The Panel has reviewed the readiness of the Shuttle Carrier Air- 
craft and inert Orblter for the first phase of the flight test program. 
It appears to us that the primary elements of the total system are in 
a development and test status so that this flight may be conducted in 
a safe manner. 

Specifically, the 747 modifications appear to be complete and the 
risks due to this part of the system well understood and controlled by 
the planned flight program. The Orbiter and its attachment to the 747 
appear to be structurally adequate under the conditions planned for the 
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tcft. The flight plan which includaa timulation of tho avonfcual drop 
altitude and velocity ia calculated to not load either the Shuttle 
Orbiter or 747 airframe beyond prudent limita (0.75 of the deaign 
load). 

After thia flight phaae, the Orbiter will go through a roodifi* 
cation and teat period to prepare it for operation aa a manned active 
ayatem. Aa can be expected there ia aubatantial work to be completed 
before the vehicle la ready for certification. The readineaa of the 
total ayatem la dependent on the completion and validation of all crit> 
leal elementa including the avlonlca and the flight control ayatem. 

During the early part of the year the major concern about the avi- 
onlca ayatem waa the definition of the apeclflcatlons for the aoftware 
and the completion of the actual aoftware programs. The Panel finds 
that the emphasis put on this problem has resulted In software dellv* 
cries and testing that seem to be adequate for the ALT tests. In these 
tests the dei>v')nds on the avionics system will be relatively simple and 
of short duration. The system. In Increasing complexity, Is being ex- 
tensively simulated at JSC, Downey and In the 101 vehicle. We think 
that the software Is acceptable unless last-minute changes are made 
that cannot be adequately verified because of time. It should be 
pointed out that the software is not being independently verified, but 
Is being validated by repetl>:ive exercising In the course of component 
and system testing. This la not necessarily bad, but we are doubling 
up the validation and verification which must be carefully monitored. 

The program for the backup flight control system Is In good shape 


11 


with a lot: o£ •xperiance^ because It was delivered relatively early 
and has been used extensively in the early testing programs. 

During the latter part o£ the year testing was begun in earnest 
using the new programs running in the 101 vehicle as well as the simu 
lotion laboratories* As might be expected, problems began to surface 
with the actual flight hardware. 

Tlte computers themselves seem to have their share of hardware 
problems, but they do not seem to be of a generic nature and should 
not be critical. However, the recent power supply problem should be 
evaluated. 

The balance of the hardware shows some problems in individual 
units, but should not affect a satisfactory ALT test. The fact that 
the testing is rather late in the game is more responsible than the 
Inherent quality of the hardware operating under the short time, rela 
tivoly simple ALT missions. 

Currently the problems being experienced are largely those re* 
lated to the total systems operation in real life. The vehicle it* 
self (101) has physical characteristics of its owi that affect feed* 
back and system response that must be ironed out by either soft or 
hardware- changes. The problem is one of tight scheduling, and the 
time needed to do the testing necessary to get the system to an ac- 
ceptable performance level for ALT. Tlie first round of system prob* 
lems is under correction and will be checked in the simulators and 
labs and then put back in 101 for verification and, hopefully, only 
fine tuning will be necessary. At this time, from an avionics point 
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of vi«Wt v« would axptct tho program fco achtava rha ALT achadula, par- 
cleularly ainca tha ftrat unmannad captlva flighfca do nor raqulra ac- 
eiva avionica, although thay may wall impinga on taatlng tiroa nacaaaary 
for larar ALT fllghta. 

Thuai the Panal'a aaaaaaroant of the avionica ayatam la that It 
will be ready and acceptable for the limited demanda of the ALT pro- 
gram> The atep-by-atep nature of ALT enhancea the confidence In the 
avionica adequacy. Tlie tearing In the varloua almulatora aa well aa 
In 101 la rapidly building up the neceaaarv verification time of the 
avionics ayatem. 

The hydraulic and flight control system has, of course, been the 
subject of Intense reviews since the recent failures during design test- 
ing and the basic design concept Is to make it a fortress rather than 
failure tolerant. 

Recent test failures Indicate that seal leakage could drain the 
hydraulic system nutklag it useless, Tlie modifications for ALT Include 
strengthened primary seals, the addition of backup seals and the addi- 
tion of a reservoir system so that any leakage woiud be slow enough for 
the system to be refilled by the reservoir until there was a safe land- 
ing. Wq agree with the need for these mods and agree that such mods 
satisfactorily reduce the risks In that part of the systent so It can 
bo used safely on ALT. The Panel concurs with the Williams' study 
that concept changes in elements of the control system should be con- 
sidered for orbital operations. 

NASA's senior management Is to be co'nmended for the comprehensive 
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review o£ the eyetem they authorized and the review done by NASA'a 
Chief Engineer, Walt Williams, and his team of non-NASA experts. The 
Panel agrees with the priorities of concern suggested by the Williams' 
group. Hie recommendations that follow rciltct our concerns. 

The Panel has given particular attention to the APU which pro- 
vides the power for the hydraulic system since it will be used longer 
on the active Orbiter flights than on orbital flights and a failure 
could deactivate all controls. Further, in order to assure sufficient 
fuel for the ALT missions the APU's will be started, stopped and re- 
started during the mission. The program's position is that the APU 
fuel capacity usage Is directly dependent on the time histories of 
actuator valve responses commanded by the avionics. Detailed simu- 
lations and validation on ADL/FCHL and SAIL of the total hydraulic 
flow requirements over a mission are being conducted. Test data Is 
being evaluated. The results of these studies and simulated flight 
demonstrations will Identify any deficiencies in capacity. 

Our recommendations on this system and other elements of the flight 
control system are noted below. 

B. RECOMMENDATIONS 

1. ‘ The Panel acknowledges the massive and dedicated effort 
applied to the avionics system during last year and can only recom- 
mend the continued use of the simulators and Orbiter lOI to build up 
the testing experietiC J the extent of which i>s the only real verifier 
of a hardware-software system. 

2. If the modified actuator system is not Installed in time 


for the regularly scheduled integrated teeta, a special thorough end 
to end Integrated test of the hydraulic system should be required for 
certification of fllghtworthlness for ALT. 

3. Parasitic uses of the main hydraulic power systems are not 
considered to be acceptable In most modem aircraft practice without 
careful attention to Isolation systems, and should be minimized or 
eliminated If possible by provision of special power systems before the 
first free flight of the Orblter (ALT). It would appear that there are 
reasonably simple solutions for all such Individual systems (brakes, 
nose wheel steering, etc.). It is possible that on ALT the reservoir 
can handle the largest expected leak. 

4. The APU's are on a very tight schedule but their thorough 
certification must not be short circuited. Further,, the Panel suggests 
serious consideration of a backup source of hydraulic power and added 
fuel capacity so that starting and stopping of the APUs In active ALT 
flights are not necessary. 

5. Orblter software presently limits control surface movement 
rate to 20^ per second. The Panel recommends that changes in software 

be considered to permit an increased rate of movement. Experience in the 
X-15, X-24, YF 16 and B-1 graphically illustrated that flight control 
problems can result from restrictive rate limits. It is understood that 
hydraulic system capacity may become a limiting factor for control sur- 
face. If simulation with higher rate control surface movement suggests 
any kind of capacity restraints on the control of the Orblter an Increase 
of capacity should be considered along with other hydraulic systems modi- 


ficAtlons now boing contompUtod* 

6. Ejictlon Mat teati (tied taato) ahould be confuted for 
velocities up to launch speeds before the first manned flight of the 
Orbiter 101 on the 747. 

7. The landing gear syatem is critical and system ground tests 
are essential to confidence in the time and certainty of drop. The 
Panel feels that nose gear shinny is as critical as extension. Nose 
gear shim ^ will be checked let the contractor and NASA's Langley Re> 
search Cen:er before free flight. The program feels a more preseing 
concern is the completion of the qualification test with static loads 
and the test of the nose gear door thruster on the simulator. The 
Panel recommendation is that management review the requirements and 
results of the certification program. 

8. The Panel has consistently emphasized that a "tail fairing 
Off" flight is one of the most persuasive reasons for the ALT program. 

This test should not be scrubbed for the reason of further need for the 
101 vehicle. It should only be scrubbed if it is determined that buffet 
levels on the 747 are too high for safety and no alternative method of 
running the test can be devised. 

■ In this respect we again note the fact that the ALT test pro- 
gram is so success oriented that any major problem, causing delay, might 
well suggest curtailment of ALT. We realize that 101 is to go to Marshall 
on a tight schedule, but would be concerned if meeting that schedule (or 
others) resulted in cancellation of tailcone-off flights or the scheduled 
tailcone-on flights. One step that can be taken is to assure immediate 
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analysis of data aftar each ALT flight so as to permit rational de« | 

I clslons before the next flight. This may permit consolidation of | 

f 

I test objectives on one or more of the tallcone-on flights, thus pro- 

I vlding time for tallcone-off flights. Prompt data reduction and anal- 

I ysls will also provide opportunities for the crews to integrate re- 

I • vised proceduree In the simulator prior to next flight. The Panel | 

i i 
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f understands that JSC la aware of and addressing this need. I 
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ORBXTER 102 


A. OBSERVATIONS 

The Orbiter vehicle echeduled for the Orbital Flight Teat (OPT) 
program la now proceeding through dealgn evaluation, manufacturing and 
aaaembly. During thla peat year the Panel focuaed on the progreaa of 
auch critical ayatema aa the flight control ayatem, avlonlca, the ex> 
ternal thermal protection ayatem and the electrical power and environ* 
mental control ayatem. 

Our aaaeasment of the flight control ayatem was outlined In our 
dlacuaalon of the system for ALT. Our basic observation Is that more 
significant modifications may be required for OFT than the make work 
changes for ALT. These are discussed in the recommendation. 

While there are challenges to certifying the avionics system for 
ALT, the Panel feels the more significant challenges are in the certi- 
fication of the system for OFT. During the year the better definition 
of software requirements pointed up the fact that while the current 
system would support ALT it would not support FOF without drastic cur- 
tailment of FOF's enhanced requirements or, conversely, an enlargement 
of the computer memory. This situation led to a decision to design and 
build a new computer with an expanded memory called "double density." 
While this decision does not necessarily Imply that entirely new and 
different software must be built, it will be important to make as much 
use of the ALT programs and test results as is possible in order to 
establish confidence in the avionics system for FOF. This could well 
turn out to be a future schedule constraint if not carefully monitored. 
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ThB d««lgn and manufacturing of tha thermal protection eyatem 
underwent major review thla paat year. Decisions have been made on the 
basic materials, coatings, optical properties and waterproofing pro< 
cesses required for each of the three types of insulation, the process 
to produce tiles of the desired properties seem to have Jelled and the 
production facilities will be on line. The question about the capabil- 
ity to deliver follow-up sets in the desired short time still remains 
since the production of one set takes a year. The method of Installing 
and bonding tiles In blocks or arrays of 160 to 200 tiles has merit. 

The problem of Installing close-out tiles between arrays has also been 
solved. Earlier discrepancies in tolerances of some important dimen- 
sions have been resolved now that there Is an Improved flow of Infor- 
mation between all the involved parties. The flatness of the coated 
surface of the tiles is defined and achievable In the manufacturing 
process. The radius of the rim of .060 Inches Is obtained by a simple 
chamferring and the subsequent flow of the coatings in the manufacturing 
process. 

Testing Is probably the biggest challenge at the moment. Fail- 
ures of different test configurations under varying environments Indi- 
cate the need for continued evaluation of the many different tile arrange- 
ments to assure they meet minimum requirements. Time to verify critical details 
Is limited. Funding constraints last year caused a reduction In testing 
and may force a curtailing of testing again this year. The certification 
activity for all TPS design details needs special attention and rigorous 
screening before the first OFT. Due to lead time Involved In updating 


teat articles, test articles sometlises do not represent the final 
vehicle configurer ion • Validity of these tests for the purpose of 
certification therefore would be queationable. 

It is obvious to the Panel that the most critical feature of the 
surface heat protection system is the assurance of closure and the in- 
tegrity of the surface temperature protection system at the ilosure 
edges or hinges. Tlie current major problem being addressed by program 
management is the configuration of the elevon hinges. The Panel agrees 
with the approach of having dual heat protection at the control surface 
hinges. The Panel has noted that efforts are being made to plan tests 
of the equivalent of hinge configurations and door edge mismatches or 
gaps in an environment approaching that of reentry. If such simulations 
can be achieved the Panel would support such tests enthusiastically. 

There are two other areas to which the Panel will give particular 
attention in the coming year. 

The JSC Technical Assessment Office has presented an analysis of 
the control capability for the reentry phase of the mission that shows 
a sufficiently narrow margin of controllability. The Panel will 
follow carefully all further analyses and subsonic correlation of 
flight dqta. If aerodynamic control margins deteriorate further re- 
design may need to be considered. 

History on fuel cells for electrical power has been sufficiently 
good that nearly all reviewers put complete reliance on the concept. 

The Panel does not question the selection of the electrical sources 
themselves but does note that electrical power is vulnerable to a 
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congentUL failure. The Panel will continue to review the fuel celle 
and mend>era will review how the three cel la are utilized when one or 
more shut-downa muat be accommodated. Our commenta on the environmental 
control ayatem are more in the form of recommendatlona to provide back- 
up to what appeara to be good ayatema. 

B. RECOMMENDATIONS 

1. The Panel la particularly concerned that the condept of par- 
allel or tandem multiple chamber piatona for elevon actuation be aeri- 
oualy conaidered for Incorporation In the planned modification of the 
control ayatem. If adoption of auch a reviaed control ayatem should 

be elected, the deaign and development program would need to be started 
Immediately. 

2. The rudder/speed brake actuation system deserves a thorough 
review for vulnerability to single point failure. For instance, a 
failure in one of the motors used to position the rudder speed brake 
could cause an overload on an adjacent motor causing the failure of all 
the motors in a zipper fashion. 

3. Increasing the APU fuel capacity on Orbiter 102 sh'uld be 
seriously considered. 

4. , The concept of hydraulic control of the main engines needs a 
critical review both for the eti^ect on the hydraulic system and to ascer- 
tain that the operation of the main engines is not subject to shut down 
due to "service" system failures when the engine itself is still operable. 
Inherent in such a reassessment should be a review of the desirability 
and potential methods for isolating the engine control system after the 
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Min «ntintt hnvt CulfilUd thtir function • 

5. Tho Panel would racomMnd that tha now computer davalopMnt 
with tha double danaity Mmory ayatam be cloaaly monitored ao aa to 
aaaura tha Mximum compatability with the praaant hardware and aoft* 
ware. Thia will inaura a backlog of axparianca from ALT to aid in 
tha verification of tha aoftwara programa for the new computer. 

6. Currently there ia very little experience to predict the be- 
havior of the thenaal protection ayatam in hyperaonic flow and there- 
fore the ayatem cannot be certified by aimilarity or analyaia. Among 
the areas that are particularly unpredictable are: 

a. The gap configurations in width, its direction with re- 
gard to the surface flow. 

b. The ateps between tile and ita tripping influence on the 
boundary layer into turbulence. 

c. Flow in door seal cavltiea and gaps. 

There will be a multitude of sub-size tiles interfacing the HRSl with 
the RCL of the nose-cap and the leading edge segments. These tiles 
will probably behave differently from the standard size tiles in the 
airflow. Therefore, the behavior of the patchwork surface and the 
effects of surface condition, gaps, or steps, etc. still appear to need 
test exposure to the environment for valid certification. 

7. The HRSI insulated umbilical doors are exposed to the flight 
environment on ascent. After separation the doors will be closed. 

There is no inspection mode or access planned to assure a proper closure. 
Consideration should be given to an on orbit inspection and repair of 


th« TPS And pareicuUrly tht uRd>UiCAl *door iaaIa to Atsuro a ia£a 
roAntryt 

8t Tho currently developed engineering criterie for TPS coating 
erosion and inspection method should include access feasibility studies. 

9, The integrity of the aluminum structure after any flight de- 
pends on the cooling efficiency of the GSE equipment after landing 
and the novel design of cooling ducts to prevent the orbiter structure 
from excessive temperatures. The design and implementation of such a 
cooling duct system has not yet been certified by a total system test 
and should be. 

10. It appears that, as a result of a good reliability history, 
the maintenance of cabin atmosphere integrity has been based on a "two 
engine" concept. This has the practical result that any failure will 
cause the termination of a mission in order to protect the crew from a 
subsequent single failure. This suggests that systems which must last 
through the total time of a mission probably should be augmented so 
that such single failures do not force mission termination for safety. 

11. The flash evaporator used to supplement radiator cooling is 
of the "fail safe" variety like the environmental system where a single 
failure .will abort the mission in order to maintain safety. A policy 
should be considered to insure that such system failures will not abort 
extensive missions in the name of safety. 


NMN ENGINE 


A. OBSERVATIONS 

Otvalopiwnt of eh* Main Engin* 1*, «• moie *v*ryonc it twar*, b*- 
hlnd achadul*. 1h* SSME Critical Daaign Review wat held in Sepiember 
1976* Becaua* of development problemc, particularly in turbomachinary, 
a number of mlleatonea that were to have been met prior to the CDR had 
not been achieved. Since then much pregroat haa been mad* in aolving 
the turbomachinery problem* and rated power level* have been reached. 
Significant improvementa have been made in pump performance. Suction 
performance of the pump* ia yet to be demonatrated. The long- lead 
part* of the turbo-machinery have been releaaed for production. In 
aome inatancea, backup deaigna have been releaaed in parallel with the 
baaeline deaign. With reapect to design and performance, the situation 
is much better than it was a year ago. While considerable progress has 
been made, the SSME was from four to six months behind its schedule as 
of late February 1977. 

Here then is our assessment of the major elements of the engine 
system. As noted, the turbomachinery has been the most troublesome 
portion of the engine development to date. The problems encountered 
include subsynchronous whirl and turbine bearing problems in the HPFTP, 
performance problems in all rotating machinery and, most recently, 
significant turbine tip seal erosion in the high pressure fuel and 
oxidizer pumps. 

Stiffening of the HPFTP shaft and a modification to the cooling 
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syitam for the turbine bearing have permitted the achievement of RPL 
for up to 61 aacondu. All cold, about 132 seconds of operation at RPL 
has been accumulated. It would appear Chat the whirl and bearing prob- 
lems have been brought under control. Significantly longer and re- 
peated testing is requireu, however, to confirm these observations and 
provide confidence in the design. 

Performance of the pumps and turbines has been Improved by de- 
creasing tip clearances, underflllng Impellers, and Impeller and volute 
changes. The Improved performance has been demonstrated on the dis- 
charge side of Che pumps. Yet to be demonstrated Is the suction per- 
formance of most of the pumps. A new engine power balance is to be 
available In mid-March. At this time It will be possible to determine 
whether Che turbo-machinery performance has Improved sufficiently to 
satisfy engine system requirements. It Is characteristic of the cycle 
employed In rhe SSME that the performance Interactions among the pumps 
are strong so that an assessment as to adequacy of performance must be 
made at Che engine system level. 

The turbine tip seal degradation Is being attacked by a seal ma- 
terials change. Indications are that the use of Bradalloy In the HPFTP 
may provide a fix. Doing the same to the turbine seal of Che HPOTP is 
being considered. 

At the time of the CDR, a potentially serious materials problem 
had surfaced concerning the low-cycle fatigue properties of Incoloy 903. 
Recently acquired data Indicated significantly lower low-cycle fatigue 
life than had been used for design. Also, data from two sources did 
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not Agree. Since then, edditionel meterUL propertioe deta have been 
obtained and a reaaaeaament o£ design assumptions, especlalljr operating 
tempratures , has been conducted, it appears that the reason lor the 
disagreement o£ the data is now understood. Sufficient conservatism 
was used in the initial design assumptions so that, upon reassessment 
in detail, all but four engine componer.es have satisfactory predicted 
life. These four are under yet more detailed scrutiny and It appears 
that any required redesign will be relatively minor. 

The 77.5:1 area ratio flight nozrle has been tested both at COCA 
4Q and on the A-2 stand at NSTL. Data that have been reduced thus far 
indicate that performance is within expected bounds. 

Teats of the heat exchanger have begun at NSTL. Thus far, no 
difficulty has been encountered and early data indicate performance to 
bo close to design predictions. Tlie combustion systems are in excellent 
shape and stability testing has been completed satisfactorily. Heat 
transfer is measured to be within design boundaries. 

Much of the auxiliary equipment has completed DVS testing. Vfttat 
remains to be done is on, or close to, schedule. 

Hie controller is still performing well in the field. A firm 
baseline configuration has been established and unit P6 is being built 
to that configuration. It will be the qualification unit. 

Controller software is on a very tight schedule with Block 1 re- 
quired for MPT. At present about seven percent memory margin is avail- 
able. 

Although recent engine system tests had to be aborted because of 
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temperature Bpikee during startup, a 61 second run at RPL was accom- 
plished March I2thi Minor modifications to the sequence may be necessary 
to assure this problem is resolved. 

«. RECOMMENDATIONS 

1. There are no specific recommendations at this time on resolving 
the existing problem since the engine development problems are well re- 
cognized by the proper levels of management and solutions are being 
sought and evaluated. However, the deadline is near wher. sustained 
engine running time at rated power levels and start transients to all 
high power levels must be attained If current milestones for major tests 
and the certification for first orbital flight are to be met. The start- 
up and turbine tip seal problems must be solved quickly so that long- 
duration runs may be achieved over the range of power levels. Repeat- 
ability of performance In meeting test objectives and consistency of 
performance from engine to engine must be demonstrated within the near 
term In order to not Impact the overall Shuttle schedule. 

2. If these requirements are not met in a timely fashion the pro- 
gram will, of course, face Important judgments as to hew to guarantee 
the necessary test time to certify the engines for manned orbital flight. 
As noted- in last year's Annual Report, the planned test program called 
for fifty-six hours of engine testing In Final Flight Configuration 
which compares favorably with the test time accumulated on the Saturn 
F-1 and F-2 engines. Contingency or recovery planning must provide 
management either the realistic schedule to meet such an objective or 
the significance of any deviations from that goal in term of the effect 
on the basis for confidence in the f lightreadiness of the engine. 


SOLID ROCKET ROOSTER 


A. OBSERVATIONS 

During this past year Che Panel has focused on Che Solid Rockec 
MoCor (SRM) as c!ne mosc significanC componenC, while a minimum of time 
has been spenC on ocher componenCs. Ocher program areas examined by 
Che Panel include Cesc and risk assessmenCs associaCed wich Che develop” 
mcnc and operaCional use of Che SRB. 

The Solid RockeC MoCor (SRM) includes a number of vical funccional 
componenCs beside^' Che basic rockeC propellanc and cases which form Che 
majoricy of Che weighC and volume. The SRM nozzle, which has a diamecer 
of 34.43 inches ac Che chroac secClon, is designed Co be gimballed or 
deflecced for accicude concrol of Che CoCal Shuccle syscem during ascenC. 
This II con, 13 fooC long nozzle requires a flexible bearing which is 
consCrucced of alcernace layers of elasComeric rubber and sCeel. The 
hydraulic supply sysCem, including Che auxiliary power uniC and hy- 
draulic pump, drives Che chrusc vecCor conCrol or nozzle gimballing 
syscem. 

The separacion syscem, Co separace Che SRB from Che ET during 
ascenC, uclllzes separacion rockec mocors and concrol system ChaC muse 
operaCe on time and wichln performance requiremenCs to assure CoCal 
and clean separation. The recovery system is all Important to the 
required reuse of Che SRB element of the coCal ShuCCle system. 

Among Che major management events this past year was completion 
of Che Solid Rocket Booster Critical Design Review (CDR) , in December 
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1976 rathar than the originally achadulad August 1977 because of the 
very good progress that has been iMtde In the design/development of the 
SRB overall and component parts. 

This period also saw the aelectlon of an overall assembly con- 
tractor with Marshall now assuming the same project management role as 
It has cn the External Tank and Main Engine projects. 

As for management at the contractor, the SRM project at the Wasatch 
Division of the Thiokol Corporation has been given a very high status in 
the company organization. The SRM Project Director reports directly to 
the Divison Vice President and General Manager. The project team con- 
sists of about 45 people including those few in the field operations 
at NASA Centers. Engineering, test, administrative and other critical 
personnel are then drawn from the 2,300 people available at the plant 
on an as required basis to form functional areas within the project 
team. Our discussions with the Thiokol personnel and the Marshall pro- 
gram administration and technical groups indicates that the Wasatch 
Division is staffed by experienced technical people at all levels. 

The NASA resident office is staffed by competent people doing an 
excellent job. 

Elements of product assurance in ^''chieving a reliable SKM include: 
(a) emphasizing the fact that this is to be a "manrated" system, (b) 
elimination of historical failure modes, and (c) sustaining personnel 
motivation. Thiokol reorganized so that product assurance is a single 
cohesive group. They are following the hazard identification and risk 
assessment system in use throughout the Shuttle program. This also 
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holds true Cor supplier controls end auditing systems. They ere dis- 
posing oC spproximately twenty materiel review board actions a %ieek 
at this time. This is expected to increase as the pace o£ fabrication 
increases. It does not seem excessive now. 

Thiokol has a contract with KSC to examine the hazards and risks 
associated with operating in VAB during the Space Shuttle build-up Cor 
flight. A first progress report was given to KSC personnel by Ihiokol 
on September 30, 1976. It consists of three components: (a) propellant 

Ignitibility testing and propagation testing, (b) outline of process com- 
pliance and hazard identification including probability of occurrence, 
and (c) consequences of ignition and recommendations (plume definition, 
exhaust composition, building involvement, and propagation control). 

Much of the technology used in the Solid Rocket Motor has been 
demonstrated on previous programs and thus provide a good basis of 
confidence in this program. 

To date over 250,000,000 pounds of the propellant used in the SRM 
has been produced for Minuteman motors and many others. It is basically 
the same with changes in the quantity of iron oxide which is used to 
control the burning rate. The higher the iron oxides the higher the 
burning 'rate in pounds per minute. Aging during storage has been demon- 
strated not to affect the viability of the propellant. Itiiokol has held 
some 40,000 pounds in storage for over 13 years and when fired has met 
all specifications. 

The case material, which is D6AC modified carbon steel has seen 
extensive use in rocket motor and aircraft applications because it has 
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a relatively high etrength and vary good fracture toughnaati It haa 
bean aatlmatad that for each uaa or firing of the SRN the caae wall 
thicknaaa will be reduced by 0.00024 inchea, which allowa for a total 
of 20 firinga (19 refurbiahmenta for operational uac). 

The aft 4^ feet of the SRM nozzle, aft of a field apliceiia aevered 
by a linear ahaped charge during the return of the SRB to the water by 
parachute. Ihla aegment is diacarded ao that the load on the atructure 
ia reduced to acceptable levela upon impingement in the ocean. Similar 
configurationa have been demonstrated on a 156>lnch motor program for 
the Poaeidon miaaile. 

The deaign safety factors for the multi-use SRM compare favorably 
with the ICBM. An extensive experience base exists for the character- 
ization of materials and the use of fabrication processes that provides 
confidence that SRM as a whole and its components should experience a 
minimum of problems as they progress through the testing program. 

Our other observations can be summarized as follows; 

1. TVo successful tests have been completed using the full- 
scale flexible bearings. 

2. The Contractor is using the vacuum casting system used on 
the Minuteroan program which has never had a motor rejected. 

3. SRM cleaning and refurbishing procedures and methods are based 
on experience gained from USAF programs. 

4. Personnel assigned to this program by the contractor have 
an average of 13 years of such experience. 

5. The contractor and MSFC continue to actively study the 
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precautions neceasary to assure full-time safe handling of the SRM's 
through every stage of the factory^ delivery and Installation activ- 
ities. 

B. RECOMMENDATIONS 

Many Important tests are to be conducted within the next few months • 
and should be the focus of attention by technical management. These 
tests Include the first development firing of the SRM, the conduct of 
the "All-Up Engineering Integrated Verification Test," and many of the 
qualification tests. Our recommendations simply identify significant 
areas that need to be monitored during the test and analysis period. 

1. The SRM, as in other areas of the SRB total assembly, are 
affected by the system aerothermodynamic loads. These latest data 
must be factored into the analysis and test as soon as practical to 
assure proper margins are maintained in the structures and other crit- 
ical areas. 

2. The nozzle bearing boot, although it has passed some tests, 
is not out of the woods as yet. There are concerns with regard to 
assuring that maximum material temperatures are not exceeded during 
the firing time and that no splits or openings occur allowing hot gas 
flow inside the bearing. 

3. The Auxiliary Power Unit has experienced some "under perform- 
ance" tests which require a reexamination and review to define the manner 
in which the performance and reliability of these important units can 

be upgraded. 

4. The use of the RDX linear shaped charge to sever the aft end 
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of th« SRM nozzle is a concern from the viewpoint of premature ignition. 
The temperatures and their duration would suggest that this item might 
be classed as a Category 1 hazard and treated accordingly. 

5. The data returned from the first Orbital Plight Test mission, 
the first time the total SRB system will be tested as part of a total 
Shuttle system, will be crucial in defining the margins the SRB makes 
available to the total system. Since the SRB's must work each and 
every time, the flight test instrumentation, its location, etc. must 
be thoughtfully considered. Where transducers are placed into bosses 
they must be fail-safe. In other words the DPI must not be thought of 
as simply an "add-on" subsystem. 


EXTERNAL TANK 


A. OBSERVATIONS 

The Panel haa been reviewing ench areaa of the program aa (1) the 
effecta of new Shuttle ayatem aerothermodynamic loadai (2) availability 
of hardware for the major Mated Vertical Ground Vibration Teat and Main 
Propulaion Teat, (3) manufacturing and welding problema, and (4) the 
aaaeaament of ET hazarda and their aignificance for the Integrated 
Shuttle ayatem. 

Launch and aacent aerothermal analyaea have been updated recently 
and there appears to be some effects on design and/or margins. For 
example, the LOX feedline bellows and bellows support, electrical 
cable trays and the forward LH 2 dome cap requires "beef-up" or material 
changes. The higher vibration levels affect Instrumentation and vent 
valves. Ihia may result In further differences between !'..in Propulsion 
Test Articles and Mated Vehicle Ground Vibration Test articles. 

As for manufacturing there has been a changeover from the type of 
vertical welding fixtures used for the Saturn V S-I-C cases to a hori- 
zontal type. Practically all weld fixtures are now In use and this Is 
a period of learning when adjustments and Improvements will have to 
be made to assure the quality of the manufactured pieces. Among the 
problems that will have to be solved are balancing the hardware and 
proper motion control and achievement of welding gap consistency. The 
problems normal to the learning curve will be solved In tlnve and the 
observance and control of all the variables will produce useable quality 
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There are additional flxturea and tooling to be Introduced, teated 
and adjusted. During this proceaa problema will occur. For instance, 
problems might be expected with the automatic TPS spray-on equitxnent 
and the process to obtain a relatively smooth outer-s’.;riace for the 
cylindrical portions of the tank as well as for both insulated end 
domes. The forward dome, exposed to higher dynamic pressure will be 
sensitive to surface discontinuities. 

The Panel continues to follow the activities of the safety, re- 
liability and quality assurance activities and their handling of major 
safety concerns. We have been giving particular attention to the hand- 
ling of the risk from the presence of wiring in the LOX tank. Teflon 
Insulated wire used for point level sensor assemblies is in direct con- 
tact with liquid and gaseous oxygen within the tank. Currently, the 
contractor is conducting development tests on these wires and other 
high temperature replacements to ascertain their properties under ex- 
pected off-nominal (high) environments. 

Also, the Panel has been following the handling of the hazard from 
ice building up on ET protuberances prior to launch and the effect of 
ice breaking off during launch and ascent when it could damage the 
Orbiter Thermal Protection system. 

B. RECOMMENDATIONS 

1. Consideration should be given to contingency planning or 
success assurance. The spray-on insulation is not expected to be 
machined over, l^at then would be done with an application that is 


too thick for th« spec becnuit of « brsakdown of a spray gun or block- 
aga of th« nozzlos. 

2. Additional managament control should be considered for the 
ET-Orbitar intar face. Thera is no plan for a mock-up or separation 
test with a complete hi-fidality mock-up. Another concern that needs 
additional assessment is the possible damage to the Tank caused by the 
separation dynamic impact loads and subsequent endangering of the 
Orbiter. 

3. Additional effort to determine the adequacy of the present 
ET/SRB attachment struts may be warranted if present struts do not 
attenuate pyro separation impact loads. Ihere are no shock absorp- 
tion devices on the ET-side of the interface. 
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RISK MANAGEHENT 


A. OBSERVATIONS 

Th« P«n«l h«B b««n following th« mothods u«cd by program manage- 
roant; to aaaaaa tha rlak laval inharent In any andaavor aa axparimental 
and aa damanding aa tha Shuttla Syatam and commanda tha continuing 
attantlon being paid by tha program to controlling thaaa riaka. 

During thla reporting period the Panel focuaed on auch apeclflc 
elementa of the rlak management ayatam aa rlak aaaeaament* configur- 
ation management and parta quality controls The rlak aaaeaament ayatem 
provldea a meana for taking Identified hazards , aaaeaalng their con- 
aequencea and determining their dlapoaltlon. Configuration management 
aaaurea that the flight hardware aa built and teated la as designed 
and therefore the design hazard analysis reflects the real hazards in 
the system. The review of parts control focused on the use of counter- 
feit electronic parts to assure they do not degrade the safety of the 
design. 

The review of the risk assessment also considered the role and 
work of iihe Safety, Reliability and Quality Assurance Screening 
Ccmmlttqe in deciding what risks should be brought to management's 
attention. This led to the expansion of the committee to Include the 
NASA Headquarters' Director of Safety, Reliability and Quality Assur- 
ance and a Panel member as an observer. This supports the group in a 
broader view of its responsibility and encourages a more effective 
voice in resolving risk and hazard problems. 


At the Panel '■ auggaatlon the committee la auditing the handling 
of aafety concerns not brought to management's attention becauee they 
are considered minor. The audit is done through the random selection 
of safety concerns which are not considered serious enough at that 
point in time to be placed In the open concern list. This permits a 
testing of the population of problems to see If any serious ones have 
been overlooked. The last sampling of the !>004- concorna consisted of 
twenty selected at random, the screening board found only one that 
was possibly close to becoming an open concern, the Safety, Hsliability 
and Quality Assurance organisation will in the next few weeks review all 
500 concerns to see if any should be upgraded. 

the procedures of the Safety, Reliability and Quality Assurance 
Screening Cornnittee have been changed to include a meeting of the group 
two weeks prior to the first captive flight with a manned active Orbiter. 
Representatives of the project and program offices, support personnel, 
and engineering design group and others would be invited to participate 
in the pre-review. The purpose is to minimize the possibility of some- 
thing having been missed that might bite the program later on and to 
minimize the chance of a surprise. In short, it amounts to a rechcck 
of the r.isks and hazards in either system integration or design charac- 
teristics. The Panel encourages this effort. 

The Panel became concerned about published reports which discussed 
the possible use of bogus parts in electronic equipment, and conducted 
a review of the steps taken to resolve this problem. 

Tests have been run on "counterfeit" parts found in the load con- 


trolUri. Thet« parts Indicate that the problem ie not one of quality, 
but one of purchasing procedure or specification. If. Indeed. "re> 
jected" parts were relabeled, appropriate action against the vendor 
should be Instituted. 

The program's response Is that the best method of assuring that 
component parts are adequate for their Intended purposes on the Shuttle 
Program Is to assure that all flight components are exposed to the 
expected flight environments for the expected mission times prior to 
the first approach and landing (FAL). These tests are required whether 
counterfeit or non-counterfelt parts are used; also, they will ensure 
that any unsuspected counterfeit parts that are In the vehicle will 
adequately meet the program requirements. If the results of Investi- 
gative efforts to determine the source of parts relabeling are suffi- 
cient to make a case, appropriate action against that vendor will be 
instituted. 

In addition to these q>eclfic reviews the Panel continued to mon- 
itor and counsel on the evolution of the technical assessment groups 
and the system for aggregate risk assessment. 

The Panel encouraged the establishment of technical assessment 
groups at each manned flight center to contribute to the "check and 
balance" function In the risk management system. As noted In last 
year's report, these groups can either trouble-shoot pressing prob- 
lems In terms of schedule impact, ecc. or they can focus on Identifying 
problems that are significant for the program's understanding of both 
specific risks and aggregate risk. Both roles are valuable but the 
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Panel favors the second one. It is, of course, Itnportant that these 
groups have the freedom to choose and pursue their own areas of In- 
vestigation so their reports are in fact independent evaluations. The 
Panel has monitored the activities of the team at JSC and found that 
they appear to have this freedom and use it effectively to review 
critical areas and thus are making a significant contribution to the 
program. 

There is general agreement that an appropriate statement of aggre- 
gate or total risk is a valuable senior management tool. A constant 
awareness provides incentives for accepting new ideas to diminish such 
risks and might encourage all \Axo had systems responsibility to suggest 
means of coping with such hazards should they occur. Such a statement 
in the Panel's opinion would Include the accepted risks and those risks 
being resolved. 

The Panel has been working with the system for preparing aggregate 
risk since the Apollo days wlien it proposed the mission safety assess- 
ment documents to aid management decision making on those critical 
flights. This is the background for saying that while the concept of 
total risk is simple the task of defining and profiling aggregate risk 
is complex for a number of reasons. This past year senior program 
management has taken a fresh look at the systems and their own require- 
ments for visibility and revised the system. 

B. RECOMMENDATIONS 

1. The Panel recognizes the accomplishments of both senior pro- 
gram and Safety, Reliability and Quality Assurance management and their 


continuing effort! to define and determine aggregate risk In a manner 
moat uaeful to senior management. The current system provides a great 
deal of risk Information, but the challenge is to assure it la a useful 
tool for the decision-makers on the Shuttle program. Mission hazard 
analyses were made on prior manned apace missions to show those safety 
concerns (dtich would constrain a mission until resolved. In this way 
they were providing the aggregate risk based on the best available In- 
formation which was examined from objective and subjective viewpoints. 
The ALT project safety assessment report has essentially done this as 
noted by this statement "Tlie JSC Safety Division considers the aggregate 
risk acceptable, based on the assessment of safety concerns to date, 
considering the accepted risks and the actions being accomplished to re- 
solve open items." Perhaps what is needed are detailed presentations 
to management by project and sub-system engineers as well as safety, 
reliability and quality assurance engineers so that statements made in 
mission safety analyses allows management to selectively review the 
background for specific Shuttle flights. 

2. As noted the technical assessment group at JSC is off to a 
good start and shows that It cun make a significant contribution to 
risk management. Since their continued effectiveness now depends upon 
the level of support and direct Interest by senior program management 
the Panel makes a point of recommending such personal attention. 

3. Tl»e effectiveness of configuration management depends upon 
the implementation of the system as described to the Panel. Tlierefore, 
the Panel recommends that audits of the operation of the system con- 


tinue to be brought to management '■ attention during thia period of 
development teating, checkout to aaaure the "aa-built" and "aa-teated" 
reflecta the "aa>deaigned" ayatema. Thia appliea to both hardware and 
software. 

4. The Panel agreea with the program inveatigatlon that the 
quality of email electronic parta in the Shuttle is adequate, and 
would suggest that in the procurement of thia class of parts that re- 
liance be placed on the performance specification rather than brand 


name. 


APPENDIX A 


NATIONAL AERONAimCS AND SPACE ADMINISTRATION 
CY 1976 ANNUAL COMPRE15ENSIVE REVIEW 
AEROSPACE SAPETY ADVISORY PANEL 


H\e Panel held its annual meeting on July 23^ 
1976 in Washington to present the observations and recommendations in 
its Annual Report before the Administrator and Deputy Administrator 
with members of the congressional staffs and aerospace media in atten- 
dance. One result of this approach was that the Aerospace Daily, which 
is widely read in the aerospace community, gave prominent coverage to 
the Panel's assessment. 

The volumes of the Annual Report to the NASA Administrator include; 

Volume I - Observations and Conclusions (III pages) 

Volume II - Sunsnary of Information Developed in the 

Panel's Fact-Finding Activities (308 pages) 

Tlie Panel, through its inspection trips, requires program 
management at both NASA and contrector levels to review and explicitly 
explain their technical management systems and decision making process, 
the basis for confidence in crew safety, and the rationale for risks 
that have had to be accepted. This approach reinforces decision mak- 
ing that minimizes crew risk. It also serves to assure problems are 
XiTorked early and at the lowest appropriate management level. The Panel 
reports to the Administrator and Congress and provides them independent 
assessment and substantial information that aids them in their over- 
sight responsibility. These reports keep before senior manned flight 
management's attention issues critical to crew safety. And because 
these reports are timely and public, they add to the public's informed 
understanding and the development of appropriate criteria of public 
accountability. 

The following paragraphs illustrate the value of the Panel's 
approach and some of their contributions to agency policy formulation, 
program 'planning, decision making, and the accomplishment of program 
objectives more efficiently and economically. Substantially more de- 
tail is in the attachment containing the Panel's recommendations on 
Shuttle and the program's response. 

The Committee on Science and Technology of the U.S. House of 
Representatives is one of the committees exercising oversight of the 
Panel. They noted in their "Space Shuttle 1977 Status Report" that: 

"The annual report of the Aerospace Safety Advisory 

Panel (ASAP), a group appointed by the Administrator 






part of tha approval cycle for Level II and III documenta pertain- 
ing to hia area of reaponcibility to aaaure effective program inte- 
gration. 


Program Plonninn end Accomplishment of ProRram Obicetivos 
Mare Effecti >^ely . One o£ the key ro1.n$ of the Panel is to alert 
management to upcoming challengea so they will be able to give them 
the appropriate attention and resources. In its assessment of the 
hydraulic system in the June 1975 Annual Report (Volume I, Page 5)| 
the Panel suggested "that management review once again the following 
areas to assure there is an adequate basis for confidence for crew 
safety in the use of single actuator on the Orbitcr elevens* " The 
more detailed assessment (Volume II, Pages 69-71) raised questions 
about the hydraulic system. Subsequent test results lent support to 
the need for this review and redesigns have been instituted for the 
systems that will fly on the Orbitcr in CY 1977 and more extensive 
changes for the system that v;ill be used on orbital flights. 

Program planning and accomplishment of objectives can be 
more efficient if past experience from related programs is effectively 
used. Therefore, the Panel suggested and the program agreed that per- 
sonnel with experience in lifting body flights be asked to participate 
in the Shuttle training aircraft program to train Orbitcr crews. 

Agency Management Decision Making . One of the continuing 
objectives of decision making is to reduce risks whenever and where- 
ever possible. This means management needs timely visibility into 
risks that are being accepted so they can assess whether the decision 
process is sound. It also means that management needs to have a timely 
reminder of significant risks so that (a) current decisions or trade- 
offs to minimize a current risk in one area does not increase the 
risk in another area, and (b) as new options to reduce previously 
accepted risks become apparent they are recognized and acted upon by 
management. Thus the Panel proposed and senior program management 
implemented a system of continuing and regular reviews for senioif 
space flight management by the reliability, quality and safety per- 
sonnel who act as a check and balance on the program. 

Another area that the Panel has reviewed is the system for 
accepting "minor risks" by working level personnel since these are not 
part of senior management’s review. The objective is to assure that 
these risks have been properly assessed and dispositioned. Thus a 
panel proposed that the risk screening board audit by sampling the 
handling of minor risks. This approach was adopted and a Panel member 
and the Director of Reliability, Quality and Safety monitor the ac- 
tivities of the Board. 

Achievement of Economics in the Program . The Panel through 
its questioning and assessments aids management in Identifying those 
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priorities that ere most significant for crew safety and mission 
success. This aids them in allocating resources to appropriate prl> 
orltles and thus helps assure the most economical use of resources. 

It Is not feasible to expect such Information from other 
advisory (groups because they arc not prir.clnally concerned with crew 
safety. To compare the Panel with line and staff organizations , Its 
membership is composed of senior executives (a) experienced In managing 
lorge development programs and risk control, (b) sensitive to the re- 
quirements of public accountability, and (c) capable of providing a 
fresh look and Independent judgment needed in a "check and balance" 
function. 


The Panel's budget is $142,000. The Increase over prior years 
Is principally because the members rate of compensation was increased 
by Congress to bring it up to the level paid other NASA consultants. 

This was an act of equity by Congress since the Panel members race had 
not changed in the eight years of the Panel's existence and they had 
been accepting a rate of compensation about two-thirds of what other 
consultants were. This had been recognized and accepted by the Panel 
but became an embarrassment when a NASA consultant was asked to Join 
the Panel because of his expertise and had to accept a reduction in 
rate of compensation. 

Panel members are selected principally in terms of (a) their 
operating and executive experience with development programs, (b) their 
experience with, and sensitivity to, Che accountability requirements 
of senior public officials, and (c^ their non- involvement in the pro- 
gram under review. All of the current members have a background in 
research and development management: and have worked with government 
programs at senior levels of accountability. 

The Panel was established by Congress in Public Law 90-67 
and has been intimately involved in the oversight of the later Apollo 
program, Skylab, and the Apollo-Soyuz Test Project. Currently it is 
working on Shuttle and will have a considerable workload through the 
development and early operational phases. It reinforces management 
attention to crew safety and works with management at NASA and its 
contractors to identify and resolve the risks inherent in a develop- 
ment program. Through its reports it aids NASA senior management and 
Congress in their oversight roles and provides the public extensive 
data for an informed understanding of program development and crew 
safety. It is unique in the NASA management system because it offers 
the experience of senior executives reviewing both policy and operating 
activities with a fresh look and independence of judgment needed in a 
"check and balance" or oversight function. 

. The objective, or criterion for organizing the Panel's work- 


46 


load, la to aaaure chat managemant for vehicle development and misaion 
operationa ndcqu&ccly provldea for crew and ground aafety. Therefore, 
given the current atage of vehicle development, the Panel will concen* 
crate on detailed ov< rsight of the dealgn, manufacturing and ground 
teat actlvltiea for Orbiter I and 2 and the naaociated elementa and 
provide appropriate reports for program and agency management. Also, 
the Panel will provide detailed oversight as mission planning for the 
early tc.n flights evolve. TIten the Pa.iel will focus on launch and 
mission prerarations and provide nd.ssion readiness aasesamonts to aid 
agency management in their decision making. 
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NASA'f Rttponitt to Coimnontt 
iiadt in the 

Aeroftpeee Safety Advisory P.anel Annual Report 
on the Space Shuttle Program 
dated June* 1976 


• Page 3* Para. l.Z.A. 

Coiwnent t There it no aargin in the eehedule to aecoinnodate 
aajor perturbations . 

Response : Space Shuttle schedules have been developed to 

provide the proper balenee concerning the amount of schedule 
time that could serve as contingency periods to eccommodate 
developiitent problems. Current Space Shuttle schedules do 
allow for normal perturbations as have been experienced in 
some instances to date with no impact to the overall schedule. 
To maintain large blocks of contingency time would be costly 
end inefficient. The Shuttle test program is designed to 
serve as verification of results obtained by other means 
(e.g.* math modelling) so that any major problems will be 
identified early in the program. 

f Page 5* Para. l.II.A.l 

Concnent ; Senior management will need to monitor: 1) the 

ability to meet minimum requirements where there are further 
reductions or changes in the major test program. 

Response ; Our review process Insures that senior management 
is Informed on major test program status and changes. This 
includes periodic reviews with the Program Director and 
Associate Administrator for Space Flight* end the establish- 
ment of ad hoc teams when special revie%^ ere felt to be 
warranted (e.g.* Space Shuttle acoustics testing* structural 
testing) . The Management Council is also apprised of signifi- 
cant issues and used as a review forum for programmatic 
changes. Finally major test status and requirement changes 
are reviewed with the Administrator. 

• Page 6* Para. 1.ZI.A.3 

Concnent : Senior management will need to monitor the realism 

Of plans and schedules for the remaining tests where there 
ere significant problems so that decisions can be made early 
rather than under schedule pressure. 

Response ; The Shuttle sumagement reviews schedules and pro- 
. gram progress on a continuing basis in order to judge their 
realism and to identify areas where increased attention may 
be required. We will continue to monitor this activity 
closely. 

ORIGINAL PAGE IS 

OF POOR QUALITY j RECEDING PAGE BIANK NOT FILMED 


• »«9« €# rAn.l.XZ.B.l 

Cowwnt i An arnn that %mrrnnti rtvitw now is tho data 
riqutrod from ALT to ouppert • flight roadinoot daeiaion on 
tha firat orbital flighta and tharafora tha currant miaaien 
planning to obtain thaaa data. 

Aaaponaa t Caraful managamant attantion haa baan appliad to 
(i) idantifieation of tha data raquirad from ALT to auppert 
a flight raadinaaa daeiaion for tha firat orbital flighta 
and (2) tha ALT flight planning raquirad to obtain thaaa 
data. Thia attantion ia avidant in nunaroua program doeu- 
manta. Voluma ZZZ* Plight Oparationa, of JfC 07700* Program 
Dafinition and Kaquiramanta* ralataa tha ALT objaetivaa to 
tha varifieation of capability for orbital flight, tpaea 
thuttla Program Diraetivaa 5A, Plight Taat Aaguiramanta* and 
34, Niaaion Evaluation Kaquiramanta , ara in affaet to aatab- 
liah raquiramanta for eroaa axehanga of data. Purthar, ALT 
Plight Taat Aaquiramanta (PTAa) hava baan davalopad to atato 
logically tha ALT data raquirad to lift apaeifie eonatrainta 
againat tha ALT and OFT programa. Tha implamantation of 
thaaa diraetivaa in miaaion planning will eentinua to raeaiva 
full managamant attantion. 

0 Paga 6, Para.l. ZZ.B.2 

Comraant : An araa that warrant a raviaw now ia tha aggragata 

riak inharant in tha "firat flight” plan to aaaura it ra- 
maina at an aeeaptabla laval. 

Baaponaa t ALT flight oparationa planning ia undar eonatant 
programmatic raviaw. Tha riaka aaaociatad with an individual 
flight ara aaaaaaad to a larga dagraa by tha Plight Taehniquaa 
Panal and raviawad by tha Plight Craw Bafaty Panal, tha Plight 
Taat Program Panal, tha Plight Oparationa Panal, and tha 
Oparationa Zntagration Baviaw and Ranga Bafaty Managamant 
proeaaaaa. Zn particular, tha Plight Craw Bafaty Panal will 
raviaw all flight taat aafaty iaauaa on a ragular baaia to 
includa tha "firat flight" riaka. Purthar, "firat flight* 
plan varifieationa will ba accompliahad uaing tha Orbitar 
aarof light aimulator and tha Bhuttla Training Aircraft. 

# Paga 6, Para.l.ZZ.B.3 

Comraant t Tha baaia for eonfidanea that tha atruetural eapa- 
bility of tha 747 tail aaction will not ba ovarleadad during 
taileona off flighta and that vibrationa will not axeaad craw 
tolaranea. 

laaponaa i Baaad on axtanaiva wind tunnal taat and analyaia 
by Boaing and Boekwall Zntamational, it baa baan aatabliahad 
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thai tht •tnietural e«pability of th« 747 tail a^etian vill 
not bt axeaadad during taileona off flighta. Tha aituation 
with ragard to 747 craw telaranca ia not eoneluaiva. To 
eoneluaivaly aatabliah tha aeeaptability of full langth tail- 
eena off flighta# it ia plannad to conduct praeuraor natad 
taileona off taxi and flight taata. Tha raaulta from nhaaa 
taata vill ba utiliaad in auiKing a final daeiaion on whathar 
to conduct tha full langth taileona off flighta. Safaty wi«l 
ba a paramount eonaidaration in tha daeiaion. 

t Page €# Para. 1. XX. 1.4 

Comnantt Tha taat raguiramants and plana to give eonfidanca 
inat iha landing gaar will daploy and lock aa raquirad. 

Paaoonaa ; Ground taata of Orbitar landing gaar daploymant 
will ba eonduetad under aimulatad flight eonditiona. Xn 
addition to ground taata# it ia plannad to conduct a daploy- 
mant taat during landing high apaad rollout of tha mated 747/ 
Orbitar. Tha raaulta of tha ground and flight taata will ba 
utilized to verify proper Orbitar landing gaar daploy and 
lock prior to Orbitar free flight. 

• Page 6# Para. 1.IZ.B.5 

Comment : An area that warranto raViaw now ia tha plan to have 

adequate iSSE at the proper place to aupport tha ALT program. 

Raaponae ; All of the GSE raquirad for ALT haa bean identified 
and daaign ia approximataly 98% complete. Aa of mid-Auguat# 
1976# there are no anticipated problama aaaociatad with having 
ALT GSE in place on time. 

• Page 6# Para. 1.XX.B.6 ^ 

Comment ; Tha flight aoftwara raquiramanta trarrant raviaw ao 
there ia an idantical flight profile for autoland and manual 

modaa. 

Baaponae ; ALT aoftwara raquiramanta for autoland and the 
manual control modaa have teen aatabliahad ao that tha pilot 
and commander will ba able to fly tha aama trajectory aa auto- 
land (within the limita of human error) . Plight plana arc 
being prepared for compatible trajactoriaa for both the outer 
120/130 and inner l.SO glide alopaa. 
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* >agt 7. »«TA. 1.XX.B.7 

Cowwyntt An Mm that w«rrnnt« fvimw now i» tho previcion 
to Allow tho eromf to odjuot tho gain of tho eentrel oyotom. 

AooDonoo : Tho proposal for pilot control of Fli^t Control 

SyatoiA (FCS) gain was diaanpx’ovod following dotailod nanago- 
■ant roviow at tho ALT Critical Ooaign Aoviow. Tho rationalo 
for this doeiaion ia diaeuaaod in dotail in our rooponao to 
tho ASAP auggostion that this proposal bo further roviowod 
(aoo our rosponao to paragraph 8.0, XXX. C. of tho ASAP 
Aoport ) . 


• Pago 7, Para. I.IZI.A. 

Coiranantt Giva attantion to tha affaetivanaaa of raeant ehangot 
in tna avioniei aanaganant approach and tha naad for a aeftwaro 
axpart in tho Toehnical Ataaasmant Offiea aa an indopandant 
advisor and chock and balance. 

hasponso! Tha naod to augment tho Technical Asaaosnant Office 
With sefttmre expertise has been known by SMnageaent. As soon 
as qualified personnel can ba found they will be added to the 
staff. 

• Page 7, Para. l.ZII.B. 

Comment ; The management system to assure that contingency 
abort ^alyses are given the proper priority now so that 
changes, particularly, in the softimre, are being suide irhilc 
there is still tho capability for phanges. 

Response: The Ascent and Entry Working Group established by 

the i^iight Operations Panel (POP) provides a focal point for 
abort analyses. The roviow and isplamontation of contingancy 
abort analysis findings are now an active function of tho FOP 
and Operations Integration Review process. 

f Page 7, Para. l.ZZI.C. 

Coanent ; Give attantion to the total or integrated managament 
plan io assure 8RB reliability. 

Response: An 8RB R,0SA plan (8E-020-005-2B) has bean baselined 

ait le'i^ XXI which constitutes an overall plan of the require- 
ments and oontrols to ensure high 8RB reliability* Tha overall 
management aystem, although the prime reaponsibility of the 
Project Office has been designed to ensure that all critical 
failure modes/hasards and their effects are identified, reviewed 
and their impact assessed eontinuously at all program levels. 

PAGE IS 
■*r F<H')r> QUAinr 
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Abov« Mid teyend th* npnuX Mjer »U«sient r«vi«wt, addi- 
tional aetivitiaa and eontrela hava baan iaiplaiiantad aa 
follewat A apaeial intareantar tfPaOA PanaX with appropriata 
aubpanaXt haa baan eraatadi joint aurvaya at aXX XavaXa ara 
baing eonduetad, CXL*a ara baing baaaXlnad to anaura nanaga- 
•ant attantion end approvaX of diapoaition aetiona/eontroXa 
and an ovaraXX ayatam XavaX faiXura raporting and tracking 
ayatam inpXanantad. 

d Paga I, Para. X.XV.A. 

Conanant : Tha aaXaction of a auitariaX and ita aiathoda of 

application for tha axtamaX inauXation, ao that tha program 
gata tha fXight parfonaanca it naada. 

Paaponaa: laaad on racantXy compXatad cryoganic taata» aa 

%faii aa fXanmabiXity raaiatanca and wind tunnaX taata at 
A£DC tha program haa baaaXinad CPR-488 compound aa tha naw 
80FX for tha axtamaX tank. Mathodt of appXication of thia 
natariaX ia tha aama aa that uaad for tha praviouaXy uaad 
compound (CPA 42X). 

• Paga 8, Para. X.XV.B. 

Coramant : Safaguarda to protact auxiXiary poirar unit with 

aaa watar axpoaura. 

Paaponaa t Tha daaign raquiramanta for tha APU raquiraa tha 
componant to hava tha capabiXity of 20 uaaa aftar aaa watar 
axpoaura. Aa indicatad in tha ASAP raport* wa hava baan 
vary auccaadful in our aaa «ratar taata in fXuahing out the 
catalytic bad and rafiring tha gaa generator succaaafuXXy. 

Ifa ara atiXX in tha procaaa of conPucting aaa watar iaaMraion 
taata of tha APU and wiXX uaa tha raauXta of thaaa taata to 
aaka any required changaa to aaaura compXianca with daaign 
raquiramanta. Soma of tha raauXta Of tha teat indicate 
diffarancaa in torque raquiramanta and aaaXant raquiramanta 
to prevent %ratar from entering tha gear box. 

• Paga 8, Para. X.XV.C.X. 

Cownant t FoXXow cXoaaXy tha proviaiona to aaaura that TPS 
inatallation procaduraa and tooXa wiXX maintain tha required 
gap and atap between tiXaa and to avoid tha probXam of an 
aarXy tripping of tha boundary Xayar. 

Paaponaa : Wa agree that thia ia an area raquiring diXigant 

ifiantlon and pXan< and prograaa ara contiaueuaXy xeviawad. 
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Rockwell «nd LeekhMd, in • «ffort» art tvalutting 

t«»o finplifiad approaehat for initalling TPS tilt arrays. 

Thaat invaatigatiens art axpaetad to bt eomplatad in 
Saptanbar» 1176 » and the aolutien ia axpaetad to aaaure 
aeeaptabla atap and gap control. 

Validity of the atringant criteria currently uaad ia aubjeet 
to raaaaaaamant but the final proof will be dataminad 
during the early flighta# where the trajaetoriaa will be 
tailored to provide adaguata aargina. 

• Page 9, Para. 1.XV.C.2. 

Conmant: Follow cloaaly the provision to adequately protect 

vehicle openings during entry with insulation while assuring 
this insulation will not obstruct the operation of doors. 

Response : A iRiniiaun of the doors are required to operate 

prior to reentry. The payload bay doors, vents, unbilical 
doors and aero sensors are exceptions. Of these, the pay- 
lead bay doors and vents are located in relatively protected 
areas and the seal on the payload bay door, which was found 
to lose its flexibility when cold, is being changed to a 
design not affected by orbital tanperatures . The uiobilical 
doors actuate after ET separation and provisions have been 
Bade to cycle the doors and latches independently for 
trouble shooting on orbit. The seals selected should not 
be vulnerable to effects of temperature encountered. The 
landing gear doors and ethers are closed and sealed prior 
to launch and no physical change is anticipated in the siaterial 
which would compromise operation. 

• Page 15, Para. 2.XZ.A.3. 

Comment : The staff of engineers in the systems engineering 

office may need to be increased. Management regularly should 
review the staffing of the systems engineering office to 
assure that its capability is appropriate for its responsibi- 
lities. 

Response: Agree. 5ome ug>ward adjustments have been made in 

the staffing of the systems engineering office. More people 
could be used productively in engineering and integration. 


• Page 15, Para. 2.XI.A.4 

Coianent t Most of the directives have to do with responsibili- 
ties lor monitoring and evaluating Space Shuttle progress 
rather than specifying how the daily work gets done or how the 
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daily intagration daciaiont ara «ada. tent do not elaarly 
dafina raaponaibilitiaa. 

Haaoonaa : Tha Syatama Bnginaaring Offiea la an organisational 

aiajnani undar tha Syatama Xntagration Hanagar and a eonvan- 
tienal managamant ralationahip aniata. Xnatruetiona to the 
tachnieal erganisationa eutaida tha program offiea « hoaavar# 

■ay taka diffarant forma dapanding upon tha natura of the 
direction and the aaaociatad impact, but ara typically from 
within tha chain of tha Laval XX SRCB, tha Syatama Xntagra- 
tion Raviaw (SXR) , or tha Tachnieal Nanagar/Taehnical Panel 
area. Raaponaibilitiaa of each ara eovarad by program 
diractivaa and need to ba eonaidarad eollaetivaly in defining 
ralationahipa. For tha axan^la cited, daily integration 
effort ia par formed by tha raaponeibla MASA/eontraetor organi- 
sation, at coordinated within the framework of the technical 
manager/panel atructure and under the guidance of the Syatems 
Engineering Office. Xaaues that need a broader review by 
nature of the interfaces or technical considerations are 
brought to the SXR, which is chaired by the Systems integra- 
tion Manager, for resolution. Those issues that involve 
requirement changes, cost or schedule impact, or substantial 
differences in technical options, are submitted to the Program 
Manager's Level XI PRCB for decision and direction. 

Page IS, Para. l.XX.A.S. 

Comment ; Work on this (system engineering) plan has been 
delayed further. Xf the plan is not to be available in a 
timely fashion, the mana^^iment will have to assure that the 
basic need that required such a document is met in another 
way. 

% 

Response ; The system engineering plan consists of engineering 
BMSter schedules and narrative sections detailing the working 
process of the responsible technical organizations. The 
heart of the plan is the schedule of input-output milestone 
commitments for the systems engineer ing/intagration effort 
across the program. A conscious decision was made to concen- 
trate on completing the milestone schedules as early as 
possible and allow the narratives to be developed as resources 
permit. The schedules have been released and in use since 
December, 1975. Since that time, improvements in detail 
definition have been made and updates are periodically incorpor- 
ated in the master schedules. A System Xntagration Manager's 
Raviaw and a Program Manager's integration Review was institu- 
ted to provide for timely discussion of integration and 
resource issues that come out of the scheduling activity. Most 
of the narrative aactions of tha plan have now bean completed 
and tha remainder ara in raviaw. This delay has not affected 
the overall purpose for which tha plans ware intended. 


f F«9« 17 « V«r«. 2.XZ.A.7. 

CQBwnt! M«wly •■tAblish«d ehi«f «ngin««r at NSW for tha 
Main Propulsion tystsra was not a mambar ot tha tyatana Znta- 
gration Raviaw Panal (SIR) at JSC. Tha panal baliavaa that 
ha should hava dir act participation and mambar ship in tha 
Systama Zntagration Rawiaw Panal activitiaa. as wall as ba 
a part of tha approval cycla for Laval XI and XXX documanta. 

Raiponaa t MS PC wrota a lattar to JSC (12 Movambar 1975) 
raquaating that Nr. Char las Wood (Chiaf Cng. at HSPC for 
tha Main Propulsion Systam) ba addad as a mambar of tha SIR. 
JSC answarad that tha organization concept of tha SZR was 
davalopad within tha contaxt of having a Kay Laval XX parti- 
cipant rapraaanting aach functional araa. Nr. Richard 
Parguaon. of JSC« was dasignatad "Tachnical Managar for 
Zntagratad Propulsion and Fluids" for tha araa of intarast 
to Nr. Wood. As such. Mr. Parguaon is availabla to eoordi- 
nata with Mr. Wood ralativa to appropriate MSFC inputs to 
tha SIR. In addition. Mr. Wood's name has baan includad for 
SZR maatings. announcements, minutes, ate. As such. Mr. wood 
has diract input to Mr. Farguson and the SZR panel for acti- 
vities pertaining to the Main Propulsion Systam. Mr. Wood has 
the same relationship to the SIR panel as Nr. J. R. !Ihong>son. 
MSFC SSME Project Manager, that is. direct participation 
in SZR panel activities in his area of interest. 

• Page 16. Para. 2.II.B.1. and 2. 

Comment t 1. The Panel favors the role of identifying pro- 
blems so the assessment groups can cover more areas of the 
program. 2. The Panel suggests that priority ba given to 
safety issues rather than non-safety issues that may seem 
more pressing. 

Response : The assessment groups operate under broad charters 

and in general, identify, review, and evaluate rather than 
%i>ork a resolution to a problem. Problem solving is the 
responsibility of the inline organizations. Tha establish- 
ment of priorities is an internal process and reflects the 
considered judgment of tha individual group and particular 
Canter aitphasis. Safety issues demand high priority but we 
would not want to exclude non-safety issues. Periodic repor- 
ting to tha Program Director and Management Council provides 
a Biachanism for reordering priorities if it is judged desir- 
able. 
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• F«9* 20* Far*. 2.ZZ.C*!. 

Cenmcntt Tht Ficplotion of « selid roektt beesttr* • aain 
•ngin* * th» MctArn*! tank* or a raaetien control oyataa In 
all likaliheed eauaa the lota of an erbitar. Thua* all 
peaaibla Maauraa «uat ba takan to prevent aueh an oecur/ranee 
or to provide earning ao that auch an exploaion could be 
prevented. 

SSME Reapona e; The Hawkina team waa chartered to conduct an 
overall aaae¥anent o£ the Space Shuttle ayatem. Out of thia 
review cane a aeparate "Engine Margin Review* whoae objective 
waa to "Reaaaeaa the SSME Structural Deaign*. Thia aaaeaament 
and atructural audit vaa conpleted and reported on to the 
Hawkina Comnittee aa well aa to top NASA officiala. Any 
additional revieira ahould atart with reviewing the reaulta of 
the Hawkina Team and the SSME Margin Review. 

In addition, the Critical Deaign Review (CDR) will be held in 
September, 1976, which will aaaeaa the maturity of the SSME 
through a review of the deaign and teating reaulta. 

SRB Reaponae: Plana are being implemented %rhieh identifier 

the approachea uaed, control methoda, and procedurea to an- 
aure proper quality controla. There plana include identifi- 
cation of all failure modea, effecta of there modea, hazard 
analyaia, aneak circuit analyaea and other riak aaaeaamenta 
that could have a potential failure mode. The reaulta of all 
there analyaea are tracked with a continual aaaeaament of 
program riaka. 

In addition to conducting aaaeaament of potential riaka to 
the SRB, apecific requirementa are ^in^oaed on the deaign to 
minimize failure a»dea. For example, there include uaing 
proven propellanta uaed in previoua aolid aioter programa, 
adding extra inaulation to prevent the poaaibility of care 
burntthrough, and a well defined development and qualifica- 
tion teat program %rtiich includea 7 motor firinga. 

QMS Reaponae : The OMS aubayatem manager and deaign peraonnel 

wmt with the ASAP people at the beginning of the QMS FOD 
development effort and adopted the following deaign/operational 
featurea for the OMS deaign to accommodate all "known* aafety 
requireamnta : (a) A fire wall ia deaigned into the pod to 

aeparate the propellant tanka from the engine proper - it ia 
not a blaat wall, however, (b) a aecond iaolation waive waa 
inatalled in the OX tanka preaaurant line between the regula- 
tor and the OX tank down atream of the "Tee* junction, which 
alao auppliea GN 2 to the fuel tank. 


.t' V, i'AGti 




57 


k Ik 


# 



(c) Th« OX and futtl fill and drain valvaa ara loeatad on 
oppoaita aidaa of tha vahicla (i.a.» fill fual fron Xt. POD 
only and fill OX from Lt. POD only ) t (d) Shuttla pilota will 
hava caution and warning lighta on propulaion panal for 
idantifieation of low praaaura eonditiona in any of tha 
fluid or pnaumatic componanta of tha OMS. 

RCS Raaponaa : (a) Tha RCS plumbing and tankaga ia daaignad 

to no-fail limita of atructural atraaaaa. (b) RCS - GSE 
will hava vapor dataction aniffar capability for paraonnal 
aafaty (pra and poat launch) . (c) RCS plumbing will ba 

laak checked pre and poat launch, (d) Filling and draining 
criteria aame aa OMS. 

• Page 20, Para. 2.II.C.2. 

Cowraent : SRB or External Tank aaparation. 

Raaponaa ; Tha aignala trhich arm and fire tha "pyrotechnic" 
davlcaa for the aolida ara dual redundant and the pyroa ara 
dual redundant. Thera ara no knovm aoftwara contingency 
tachniquaa to deal with tha vary remote problem of tha fail- 
uza of the aolida to aeparata. 

• Page 20, Para. 2.XI.C.3 

Comment ; In tha early flighta there will ba no Shuttla to 
perform raacua aarvicaa, ao effort ahould ba Mda to minimiza 
continganciaa %rhich might cauaa raacua to ba needed. Thaaa 
include doora (payload bay doora, or umbilical door) which 
cannot ba cloaad prior to reentry or tha failure of tha 
external tank to aeparata. 

Reaponaa ; Tha Space Shuttla ia not daaignad to ba dependant 
upon a raacua vahicla aa a contingency backup. Craw aafaty 
raquiramanta ara tha aame aa for pravioua programa where no 
raacua capability axiatad. Payload bay doora, for example, 
aniat ba cloaad prior to reentry. The doora cannot ba adequa- 
tely verified aa a ayatam, prior to flight, bacauaa of tha 
one *g* environment. Reliability will depend on aiaqpla, 
atraight forward daaign which ia amenable to enalyaia, end 
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eompon«nt tttting. On any flight during which the doors will 
be opened, EVA eepebility will be provided, together with the 
neeeeeery tools, etc. to permit menuel closure of the doors 
by en EVA crewmen. 

g Pege 21, Pere* 2.XZ.C.4. 

Comment : Suggested thet input end output devices end meche- 

nisms oe reviewed to doubly eesure no "herd-overs* cen exist. 

Response ; The solids end the mein engine gimbel systems ere 
controlled by four port force-sum eetuetors. The system is 
being designed to tolerete two consecutive failures. Zn 
the remote case of e mein "engine out* problem the failed 
engine will be gimbelled in e feil-sefe position such thet 
the remaining two cen be gimbelled through their full 
authority of * 10.5 degrees pitch end 4 8.5 degrees yew. 
Znput-Output Hevices end mechanisms foF controlling the 
engine gimbell's ere under constant analyses end reviews. 

• Pege 21, Pere. 2.XI.C.5 

Comment t Adequacy of test end APU system design should be 
cevlMriid. 

Response ; JSC indicated the APU is currently under safety 
end operational review end will continue to be so until ell 
SSME gimbel end other hydraulic system functions ere satis- 
fied. 

A turbine %rheel scatter shield has been designed into the 
turbine housing assembly to preclude a category 1 failure 
from an exploding turbine wheel. « 

f Page 21, Para. 2.ZZ.C.6 

Comment : Loss of pressure in the cabin appears to be a 

singular end important hasard. There are two cabin air 
supply systems and three fuel cells «rtiich provide cabin air 
pressure end conditioning. The system must operate for the 
entire mission and total failure would be fatal. Zt is 
suggested that a concentrated review take place seeking once 
again the strong confirmation that there is a remote enough 
risk to take. A third air supply system sdght be feasible 
and valuable. 
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HttPonM t W« agro that tha loaa of cabin praaaura ia a 
critical and im^rtant hazard. Thara ara two ganaral 
catagoriaa of failuraa idiich could result in tha loaa of 
cabin praaaura. Ona ia tha loaa of praaaura by axtarnal 
laaXa? tha other, by failure of tha gas distribution and 
control ayatam itself. An ancillary high praaaura oxygen 
tank ia provided for amargancy backup. Zn tha event of 
axcaaaiva axtarnal leakage, it will provide an 6 paig 
cabin pressure for a leak aparatura equivalent to a .45 
dia. hole for 165 minutaa. An incident of such a leak ia 
considered to be remote. 

Tha primary mode of oxygen supply ia from tha fuel call 
power reactant tanka. Tha nitrogen ia stored in four high 
pressure vaaaala. Many of tha ayatams components ara 
identical to those of tha Skylab which functioned perfect- 
ly for 171 days. Other redundant functions and hardware 
have been incorporated into the Orbiter, such as two stage 
pressure regulation, crossover manifolds, isolation values 
and manual controls. Failure mode and effects analyses 
have identified the most critical hazards and certification/ 
qualification plans have been baselined. We believe the 
addition of a third air supply would result in unnecessary 
cost, weight and coiqplexity. We feel the continuing atten- 
tion to the development and qualification of our present 
baseline will result in low risk to crew safety and mission 
success. 

e P age 22. P ar a. 2. XX. C. 7 

Comment ; Reevaluate Total System 

Response ; The controls and the APIJ systems are three 
parallel systems. Two APU systems are required to share 
the load. 

• Page 22, Para. 2. XI. C. 8 

Comment ; "Destruct" decisions for operational flight are 
needed. 

Response ; Decisions regarding enployment of a flight ter- 
mination system during the STS operational time period will 
not be made for sometime. Xn the next two years, the joint 
KASA USAF Range Safety Ad Hoc Comnittee will be eiqploring 
the risk-benefit considerations of planned operations. The 
involuntary risk must be siaintained at a level acceptable to 
the public and at the same time bear a reasonable relationship 
to the voluntary risk accepted by flight personnel. We do not 
eiq>ect that decisions in this area icLll be confizsied until the 
OFT series is conpleted. 
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• Pag« 23« Para. 2. ZZ. C 


Conwnt t A timilar datail r«vi«w should bs mads of ths 
eressovsr e^>abillty idiieh axists on ths control systam to 
Maintain hydraulic prsssurs in ths svsnt of APU failurs with 
spscific focus on ths adsquacy of maintaining hydraulic prss- 
surs in ths main sngins control valvs systsm. Zf an APU 
shuts down thsrs will bs an automatic shutdown of that sngins 
bsing ssrvsd. 

Ksspon sa t Zn ths svsnt of an APU failurs. crossovsr capa- 
Dility sxists to maintain hydraulic prsssurs in ths S5ME TVC« 
slsvon actuators and whssl brakes. Whils crossover 
capability doss not exist for SSNE propellant control (due to 
cost, schedule and %#sight considerations), mission safety is 
not compromised. An APU failure %^uld result in the shutdoim 
of one SSME which %#ould result in a safe intact abort case. 

• Page 24, Para. 2. ZII. A. 

Comment : “Conftrehensive review of integrating groups 

operations should be conducted regularly to insure respon- 
siveness to program needs." 

Response ; Agree. The integration activity in support of 
program requirements is highlighted through reviews with the 
Program Director, Associate Administrator for Space Flight, 
and selected Management Council topics. Special technical 
reviews are held in areas vdiere support is critical, and, 
resource adjustments are made if required. The system inte- 
gration organization and %a3rking relationships are well 
established but changes are made in panel structure and 
assignments as inprovements are nepded. 

• Page 24, Para. 2. ZZI. C. and D. 

Coninent ; C. Individuals at the systems integration level 
at JSC and at Rockwell's Space Division should be given 
appropriate management responsibility, authority and re- 
sources for contingency analysis and planning. 

D. Analysis and evaluation of vehicle capability for off- 
design eases should be done now. rather than later tdien 
necessary changes would be prohibitively costly. Staffing 
needed for this effort shoxild be provided. 

Response : Most of the vehicle analysis for off-design/ 

contingency capability has been delayed in deference to 
design/analysis effort in support of the Critical Design 
Review (CDR). This is an acceptable approach since no 
major hardware changes are anticipated to provide for con- 
tingency capability. Minor changes could be incorporated 
after the CDR. 
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